Can the police keep my data, DNA, fingerprints, and other records?

The police hold a range of data about individuals, from basic records on the Police National Computer (PNC) to biometric data such as DNA profiles and fingerprints. The rules on what they can keep, and for how long, depend on the type of data and the outcome of any investigation.

If you are convicted of a recordable offence, your DNA profile, fingerprints, and PNC record can be retained indefinitely. A recordable offence is any offence that can result in a prison sentence, plus certain specified non-imprisonable offences. This means that even a minor conviction can result in a permanent record. If you receive a caution, the retention period depends on the offence. For qualifying offences, retention is indefinite (the same as a conviction). For non-qualifying offences, a simple caution permits retention for a limited period only, not indefinite.

The position changed significantly after the European Court of Human Rights ruling in S and Marper v United Kingdom (2008), which found that blanket retention of DNA from unconvicted persons violated Article 8 of the European Convention on Human Rights. Parliament responded with the Protection of Freedoms Act 2012, which introduced strict time limits on retention. If you are arrested but not convicted, your DNA and fingerprints must generally be deleted. There are exceptions for qualifying offences, where retention is automatic for 3 years under PACE s.63F(3). The Biometrics Commissioner's role is in considering national security determinations (up to 2 years, renewable) and extensions beyond the initial 3-year period.

You have the right to make a subject access request under the Data Protection Act 2018 to find out what data the police hold about you. This covers PNC records, intelligence records, custody records, and any other personal data. The police must respond within one month and can only refuse or redact information in limited circumstances, such as where disclosure would prejudice an ongoing investigation or national security.

If you believe your data is being retained unlawfully, you can apply to have it deleted. For biometric data, the route is through the Biometrics Commissioner. For other data, you can complain to the Information Commission, to which the functions of the Information Commissioner transferred on 30 September 2026. The police must follow the College of Policing's Management of Police Information guidance and the National Retention Assessment Criteria when deciding how long to retain intelligence and other records.

Key Points

• Convicted persons' DNA, fingerprints, and PNC records can be retained indefinitely
• If you are arrested but not convicted, biometric data must generally be deleted under the Protection of Freedoms Act 2012
• For serious offences, police can apply to the Biometrics Commissioner to retain unconvicted persons' data for up to three years
• You can make a subject access request under the Data Protection Act 2018 to find out what data police hold about you
• The S and Marper ruling ended blanket retention of DNA from unconvicted persons in the UK
• PNC records may be retained even where biometric data must be deleted
• You can apply to have unlawfully retained data deleted via the Biometrics Commissioner or the Information Commission
• The police must follow College of Policing retention guidance when managing your records

Updated 16 October 2026: the office of Information Commissioner was abolished and its functions transferred to the Information Commission on 30 September 2026 (Data (Use and Access) Act 2025, ss.118 and 119, commenced by SI 2026/1015; consequential amendments by SI 2026/386).